Russian Hacker Used Jailbroken Gemini to Steal Admin Credentials and Drain Crypto Wallets

Cybersecuritynews •Guru Baran • May 25, 2026

A solo Russian-speaking threat actor leveraged a jailbroken instance of Google Gemini to run a five-year MAGA-themed influence operation, crack WordPress administrator credentials, and empty at least one victim’s cryptocurrency wallet, all at near-zero cost using stolen API keys. In May 2026, TrendAI™ Research uncovered the full operational infrastructure of a threat actor tracked as […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Russian Hacker Exploits Jailbroken Gemini to Target MAGA Crypto Users A Russian-speaking hacker, identified as bandcampro, utilized a jailbroken Google Gemini to execute a cybercrime campaign targeting MAGA supporters from September 2025 to May 2026. The operation involved impersonating an American veteran and running a Telegram channel to distribute malware disguised as a cryptocurrency wallet. The attacker successfully compromised at least one victim's crypto wallet by stealing passwords and mnemonic phrases. The campaign leveraged AI-generated content and a brute-forcing tool to crack WordPress admin credentials. TrendAI researchers uncovered the attack infrastructure in May 2026, revealing the sophistication of the methods employed. The attack primarily aimed at cryptocurrency fraud rather than political motives, despite its MAGA-themed influence. The hacker's operational costs were minimal, relying mainly on stolen API keys. The incident highlights vulnerabilities in AI systems and the potential for exploitation in cybercrime. 7 sources 67

Russian Hacker Used Jailbroken Gemini to Steal Admin Credentials and Drain Crypto Wallets

The full story

Extracted Entities

MITRE ATT&CK (1)

Platforms (2)